Windows 10: What is event 4672?

I've experienced some real interesting and worrying issues with my pc. It has taken over my life effected me psychologically and I feel as if in a virtual prison. I got 1903. What is going on?

:)

 

Events 4672 & 4624 Win 10 Freezes - special LOGON ?

Hi,

Thank you for writing to Microsoft Community Forums.

1. Are you on a domain network?
   
2. May I know the make and the model number of your system?
   

The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
4672(S): Special privileges assigned to new logon.

The Windows error logs will be located at Event Viewer > Windows Logs > System.

Please follow the step below and check if it works for you.

Step: Improve Windows 10 Performance.

Try some of the following suggestions to help
make your Windows 10 PC run better. The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
the OS will reverted back to previous version you upgraded from.

If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

Hope it helps.

Amit Sunar

Microsoft Community – Moderator

 

Event 4672 & 4624 & 5379 PC Freezing

I have had this for a while now but it seems to have gotten worse recently. My PC has been freezing (1-4 seconds every hour or so) and the only thing that I can tie in is these Events happening at the same time as the freeze all the time.

Events 4672 (Special privileges assigned to new logon) and 4624 (An account was successfully logged on) happen together 3 times and Event 5379 (Credential Manager credentials were read) happens 9 times and i'm positive this is what is causing this.

Anyone have any thoughts as to why this causes a lockup?

 

Event id is 4672 and Delegate Session User (windows 10 - security)

Is this an event log of an intrusion in the computer?

I ask this particulary because the event id is 4672, which means special privilegies, and because of the "DelegateSessionUserImpersonatePrivilege". Is this mean that someone else have access to the computer?

And, btw, in the windows 10 home edition how to deny that "delegate session user"?

Thanks

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

<EventID>4672</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>12548</Task>

<Opcode>0</Opcode>

<Keywords>0x8020000000000000</Keywords>

<TimeCreated SystemTime="2018-01-25T10:52:17.045832200Z" />

<EventRecordID>58738</EventRecordID>

<Correlation ActivityID="{A16D797C-92DD-0001-E879-6DA1DD92D301}" />

<Execution ProcessID="684" ThreadID="25696" />

<Channel>Security</Channel>

<Computer>DESKTOP-FTOPHRU</Computer>

<Security />

</System>

<EventData>

<Data Name="SubjectUserSid">S-1-5-18</Data>

<Data Name="SubjectUserName">SYSTEM</Data>

<Data Name="SubjectDomainName">NT AUTHORITY</Data>

<Data Name="SubjectLogonId">0x3e7</Data>

<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

SeDelegateSessionUserImpersonatePrivilege</Data>

</EventData>

</Event>